Linux kernel io_uring/query: unclamped user size lets a local task request ~4 GiB of clear_user zeroing

Impact

io_handle_query_entry() clamped hdr.size for the inbound copy but kept the original user-supplied value for the outbound copy_struct_to_user(), which clear_user()s the trailing bytes. Because hdr.size is a u32, an unprivileged task can ask the kernel to zero close to 4 GiB of user memory, including on the error path where the result size is zero. That is a local denial-of-service primitive against a shared GPU node - burned CPU in kernel context on a machine other tenants are sharing. The interface is reachable through IORING_REGISTER_QUERY without even creating a ring, so any container that has not blocked io_uring by seccomp can hit it.

Who can reach it

Any local user or container task permitted to call io_uring_register. No authentication beyond being able to run code on the node; tenant pods qualify unless io_uring is filtered.

What to do

Update to a stable kernel containing the PAGE_SIZE cap (three backport commits linked) and reboot the node. Until then the practical mitigation is the one many operators already run: disable io_uring for untrusted workloads via the sysctl or a seccomp profile that blocks io_uring_setup/io_uring_register. Kernel rollout on a GPU fleet is a drain-and-reboot per node.

References

Related entries

• Linux kernel io_uring/waitid: canceled task work runs __do_wait() in the wrong task contextCVE-2026-81010 · Linux kernel io_uring waitid (task_work cancellation handling)Unscored
• Linux kernel Intel Speed Select: unvalidated ioctl indices reach MMIO offsets and NULL instancesCVE-2026-89438 · Linux kernel Intel SST driver (isst_if_common ioctl input validation)Unscored
• Linux kernel iommufd: current IOAS rwsem and reference leaked when the unwind path misses itCVE-2026-89446 · Linux kernel iommufd (IOAS rwsem and object reference left held on xa_store failure)Unscored
• Linux kernel iommufd: reference leak on unmap when an internal access is skippedCVE-2026-89447 · Linux kernel iommufd (object reference leak when skipping internal accesses on unmap)Unscored
• Linux kernel VT-d: ACS not requested under tboot, leaving peer-to-peer DMA isolation offCVE-2026-89448 · Linux kernel iommu/vt-d (ACS request when tboot forces the IOMMU on)Unscored
• Linux kernel Tegra241 CMDQV: oversized guest vSID truncates and aliases the wrong Stream IDCVE-2026-89450 · Linux kernel iommu/tegra241-cmdqv (guest vSID programmed into SID_MATCH)Unscored